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Description 

The invention relates to digital communications. More specifically, the invention relate* tq network management. 
IT! Today, large number* of personal computers and workstations are being Interconnected with file servers, print 

W servers, modems, hubs and other devices to form local area networks, metropolitan area networks and wide area 

' networks. These networks albw the personal computers and workstations to share Informetionland valuable resources 

among each other. Now more than ever, Individuals and companies depend on networks to conduct business and to 
to communicate with people around the world. Indeed, the network has become the computer. I 
^ A network manager is employed to control operations of devices on the network, analyze] resource performance, 

™ Identify and resolve faults, and automate management tasks. Track of the devices Is kept by way of a network topology 

\T databaee. The network manager can dynamically build the database by discovering the device* thai are on the network 

and adding the discovered devices to the database, 
p; 15 A conventional method of discovering devices Is known as "serial pinging." The network mahager sends an Internet 

m Control Message Protocol (I CMP) echo request message to an address and waits for a response. After a response Is 

received, or after a timeout Interval expires, the network manager sends an ICMP echo request message to the next 
aerial address. These steps are performed until ICMP echo request messages have been senj to all addresses on the 
O network. The devloea that respond ere added to the network topology database. 

20 Serial pinging has Its problems. Forone, It can be take a vary longtime to discover a devlck. Networks of the Olass 

^ C type support up to 265 addressee, but not all of those addresses will bs active. Even though only 6 devloes might 

be active on a class C network, requests would still be sent serially to aO 255 addresses. Vfeftlng 3 or 4 seconds for 
each non-response at 250 addresses, the network manager could take as long as 16 minutes to locate a host on a 
class 0 network, The problem is lar greater with class B networks (which support up to 65,000 addresses) and class 
23 A networks (which support up to 65 million addresses). On a class A network it could take as Ipng as a week to locate 
a host. 

Another problem with serial pinging Is that It Increases the traffic on the network and, consequently, slows down 
other devices on the network. Many devices atop oommuntcatlng with other devices in order Ito respond to an ICMP 
echo response rsquest message. j 
90 Yet another problem with pinging Is that the msthod, as exhaustive as It might be, Is not guaranteed to identify all 

devices on a network. Some routers, when busy will Ignore ICMP echo request messages alljogether. 

j 

SummflfY 9fthe Invention 

35 These problems are overcome by apparatus and methods according to the present invention. A first method of 
discovering devices on a network comprises the steps of accessing an ARP table from at ijraet one device on the 
network; and using each accessed ARP table to Identify other devices on the network. The firpt method can discover 
devices on the network at far greater speed than the conventional method of sending ping* The first method also 
creates far lass traffic on the network when discovering the devicee. 

49 A second msthod of discovering devices on a network comprises the steps of sending batches of pings to different 

addresses on the network; and, for each batch, waiting an Interval tor responess from deviclea at those addressee. 
After the interval elapses, another batch of pings Is sent The eecond method is also faster than the conventional 
method of sending pings. It can be performed independent of, or In combination with, the first method of discovering 
devices on a network. 

4S A method of determining a hierarchical structure of a network comprises the steps of aoceeeing routing tables to 

Identify routers on the network; accessing address tran elation tables from the routers to Identify other devices on the 
network; and saving IP addresses of the routers and the other devices on the accessed routing tables and address 
translation tables. 

An apparatus for discovering devices on a network comprises a processor tor accessing at least one routing table, 
so identifying gateways within N hops on each routing table that Is accessed, where N Is a positive integer accessing 
ARP tables from the gateways that are Identified, and Identifying devices on the ARP tables thai are accessed. 

A network manager for managing addressable devices on at least one network comprises ^processor and memory 
for storing a network topology database and a plurality of executable Instructions. When executed, the instructions 
Instruct the processor to use routtng tables to Identity routers within N hops; retrieve ARP tables from the Identified 
55 routers; Identify devices on the retrieved ARP tables; access Information from the Identified devices; and add the 
Information to the network topology database. 

The Invention alec includes a computer storage medium that stores e plurality of executable instructions tor In- 
structing a computer to discover d evioes on a network The plurality of Instructions comprises in struct j one which instruct 
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the computer to use routing tables to Identify gateway* within N hops; Instructions which ijnotruct the computer to 
retrieve the address translation tabids from the Identified gateways; and Instructions which Instruct the computer to 
Identify devices on the retrieved address translation tables 

a Mtf Description of the Drawings 

i 

Figure 1 Is a schematic diagram of a network Including a network manager according to the present invention; 
Figure 2 Is a block diagram of the network manager according to the present Invention; 
Figure 3 Is a flowchart of a method of discovering devices on a network, the method being performed by the network 
10 manager according to me present Invention; and 

Figure 4 is a flowchart of a Fast Ping method according to the present Invention. 
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Detailed Description of the Invention 

Figure 1 shows a network 10 which, for Illustrative purposee, includes first, second and t tlrd subnets 91, 32 and 
B9. The subnets 81, 62 and 83 can have the seme topology or they can have different topologies. The topologies 
include, but are not limited to, Token ring, Ethernet, X 26 and FDDI. Devices 12, 14 and 18 are connected to the first 
subnet 31 ; devices 1 8. 20. 22 and 24 are connected to the second subnet S2; and devices 2 3, 28, 30, 32 and 34 are 
connected to the third subnet S3. The devices 12*34 can be workstations, personal compu ere, hubs, printers, etc. 
Additional devices on the network 10 fridude a first router 36 tor Interconnecting the first, second and third subnets 
81, 92 and S3; and a second router 38 for connecting the second subnet S2 to other networks. The network 10 is 
scalable, which allows computing resources to be added as needed, Although only several din/Ices 12*38 are shown, 
the network 10 can encompass tens of addressable devices up to tens of thousands of addressable devices. 

TCP/IP Is used to regulate how data Is paoketed into IP packets and transported between he devices 12-38. Each 
device 12-38 has a physical address and a unique Internet protocol (IP) eddrees. The IP adcress Includes a network 
number and a host number. The host number is broken down into a subnet part and a host p art. 

lake a first example In which IP packets are sent from a source device on the first subnet 81 (device 12, for 
example) to a destination device on the first subnet 81 (device 14, for example). The IP paokets contain the IP address 
of the destination device 14. The subnet part of the destination IP address Indicates that the destination device 1 4 is 
looal, so the source device 12 retrieves Its local ARP (Address Resolution Protocol) table from Its ARP cache. The 
ARP table Is used for mapping the IP address onto a physical address, tf the destination IP address Is found on the 
ARP table, the source device 1 2 reads the physical address off the local ARP table, adds appro; >rlate headers (Including 
the physical eddrass of the destination device 1 4) to the IP packets, and sends t he resulting f n}me over the first subnet 
81. ; 

If the destination device 14 is not on the ARP table, the source device 12 Issues an ArtP request to locate the 
destination device 14. The ARP request includes the IP and physical addresses of the eourfce device 12 and the IP 
address of the destination device 1 4. AJl devices receiving the ARP request check to eee if ttjieir IP address matches 
the destination IP address In the ARP request. Of course, the destination device 14 makes aimatch and responds by 
returning Its physical address to the sou roe device 1 2. The source device 1 2 makes en entry f p r th e destination device 
14 in its ARP table (the entry including the physical address of the destination device 14), adds the physical address 
of ths desttiation device 14 to the IP packets, and transmits the resulting frames over the flrdt subnet 33. 

lake a second example In which IP packets are sent from the source device 12 to a destination device on the third 
subnet S3 (device 30. for example). The subnet part of the destination IP address Indicates that the destination device 
30 Is not local, so the source device 12 rstrievss its local routing table from the ARP cachet The local routing table 
contains Information needed to route the I P packets to next-hop gateways . Ths In formation Inel udes entries thai Indicate 
the next-hop routers by their IP addresses. At a minimum, the looal routing table contains an entry for a dslault router, 
In this example, the default router le the first router 38. The routing table may also contain meiy other entries for other 
□atewaye on the network 10. The source device 1 2 forwards the IP packets to the first router; 38. 

The first router 38 receives the IP packets and retrieves an IP address table from its ARP cache. The IP address 
table Includes an addresa for each biterface. In this example, the IP address table includes IP address 129. 144.74.1 
for the first eubnet 81 , IP address 1 20.1 44.75.1 for the second subnet 82, and IP address 129. 1 44.76.1 for the third 
subnet S3. By masking the destination IP address to obtain its subnet part (a mask from ths IP satire table Is used) 
and comparing the masked IP address to the addresses in the I P address table, the first router 30 determines that the 
IP paokets should be sent to the third subnet S3. The first router 36 looks at its ARP table (which was retrieved with 
the IP address table) for the physical address of the destination device 3a The first router 3e ; maintains an ARP table 
of the devices that have been active (i.e., communicating) over an interval (e.g., five minutes). 

If the destination IP address Is not on its ARP table, the first router 36 issues an ARP request. After the destination 
device 30 Is found, the first router 36 adds the destination physical address to the IP packets and transmits ths resulting 
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frames over the third subnet S3 to the destination device 30. 

Had the destination IP address not lit hi one of the subnets on the IP address table, the f irjsl router 36 would have 
checked its routing table (which was also retrieved with the IP address table) and forwarded thp IP packets to the next- 
hop router (I.e., the second router 38). 

The network 10 additionally includes a network manager 40, which la connected to the 
Network Management Protocol (8NMP) le used by the network manager 40 for managing the 
SNMR The devices 12-39 that do not support SNMP can be managed by a protocol such 
manageable device stores in its memory a Management Information Base (MIB). The MIB Is 
variables representing different aspects of the devfoe (e.g., cortfigu ration, statistics, status, 
associated with an agent, which is a software program that may or may not be resident In the dj 
the network manager 40 to access the MIB of each SNMP-manageabie device. Such accessibility allows the network 
manager 40 to perform Its management taake. For a general description of network management see W. Stallings, 
"Data and Computer Communications/ MaoMillan (4th ed, 1 994) pp. 701 -24, which la Irworporajed herein by relerence. 

Fig jre 2 shows the network manager 40 In greater detail. The network manager 40 include* a workstation 42 such 
as a SPARCaietlon orSPARCeerver. Both of these models use a RISC-based higjvperformahce SPARC microproc- 
essor 43. Ths 8PARCstatton p SPARGserver. and 8PARC microprocessor are all commercially available from 8un 
Microsystems, Inc., the assignee of the present invention. The workstation 42 le configured with a color display monitor 
44 and a CD ROM drive 46 for distribution media, it Ja atso configured with volatile memory {46 sueh as DRAM and 
non -volatile memory SO such as a hard drive. 

The Network Manager 10 Includes a UNIX-baaed operating system 52. Operating systems for the 8 PARC micro- 
processor Include SOLARIS 2.4 or greater and SOLARIS 1 .sc or later. The SOLARIS operating^ systems are also com- 
mercially available from the assignee of the present Invention. The operating system 52 islstored on the network 
manager's hard drive 60, j 

Also stored on the hard drive 50 la software for directing the network manager 40 to perform He many leaks. The 
software Includes a Graphical User Interface (QUI) 54, a network topology database 56 and a Discover program 58. 
Running the Discover program 58, the network manager 40 seeks out IP and SNMP-addrsesable devices on the 
network 10, and adda Instances of discovered devices to the network topology database 68. 1 

The Discover program 58 can be distributed on a portable computer memory medium, such as a CD ROM. Dis- 
tributed as such, the CD ROM le Ineerted Into the CD ROM drive 46 and the Discover program 6B la Installed onto the 
hard drive 60. Instead of Inataflln g the Discover program 56 onto th e hard drive 50, however, It c^n be accessed directly 
from the CD ROM drive 46. 

Ths Discover program 58 can be run directly from the operating system 52. The location arid name of the Discover 
program's executable file are typed In at the command Une. Specifiers can also be typed In ejt the command line, or 
they can be provided in a configuration file. If no specifiers are typed in at the command line,, default specifiers are 
used. The specifiers, which provide options for running and configuring the program, will be djecusaed below 

In the alternative, the Discover program 58 can be run from the GUI 54. A Discover program icon la double clicked, 
causing a Discover Properties dialog boxto appear. The Discover Properties dialog box shows the current configuration 
of the Discover program, provides an option that allows the Discover program to be reconfigured with new specifiers, 
and a button for running the Discover program 58 as currently configured. The GUI 64 can be oreated using Open- 
Widows 3.1 or later, or any other library of graphical user Interlace classes. 

Reference le now made to Figure 3, which shows the stepe performed by the network man gar 40 under the direction 
of the Discover program 58. The Discover program 58 offers a choice of searches: an ARP/Pinjg search, an ARP-only 
search, and a Ping search (step 100). One is selected. The ARP/Ping search is selected by default. If It le desired to 
perform either the ARP-only search or the Plng search, a specifier (e.g., -A or -P) is typed In at the command line or 
button (e.g., ARP-only button or Ping button) Is clicked on In ths Discover Properties dialog box. 

The network manager 40 begina with the stepe of building a hierarchical data structure of the network topology 
The hierarchical data structure Indicates networks, subnets for each network, and gateways, hosts and links (physical 
and logical) for each subnet. The data atructure le storsd in non-volatile memory 50. To build the hierarchical data 
structure, the network manager 40 accesses its IP address labia and local routing table in its ARP cache (step 102). 
I P addresses In the IP address table, wh leh are used to Identify the subnets, are added to the hierarchical data etruotu re 
(step 1 04) . The local routing table is used to Identify a delau It router. The local routing table might also Identify additional 
gateways. IP addresses of the default router and any other gateways are added to the hierarchical data atructure (step 
106). 

The IP addresses of the routers are also added to a Gateway list, which Is stored In memory 48 or 60. Before a 
gateway Is saved in the Gateway list, however, the network manager 40 poriormQ a iracerout as operation to determine 
the number of hope to that gateway (step 108). Each gateway that a packet must traverse to counted aa a hop. The 
traceroutea operation also idenUfiee physical and logical (Inks, which are added to the hierarchical data structure (atsp 
110). If a gateway le within a 'Maximum Hops' threshold, Its IP address is appended to the Gateway list (step 112). 
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By defauft the Maximum Hope threshold la eat to zaro ao that only the local ARP cache is accessed. 

If the Maximum Hope threshold is greater than zero (step 114), the network manager 40 retrieve* the routing table, 
IP address table and ARP table of the default router using a aerie* of 8NMP GetJMext messages (step 116). The 
default router's IP address table Indicates the IP addressee of the subnets S2 and S2 and any other Interfaces. IP 
addressee of the Interfaces ere added to the hierarchical data structure (step 116). The deiaiilt rooters routing table 
Identifies other gateways, which are added to the hierarchical data structure. Only IP addresses of those gateways 
within the Maximum Hops threshold are appended to ths Gateway list (step 120). 

If the default router does not support SNMP, the network manager 40 can use the trace routed operation to find 
additional gateways. It additional gateways are found, their IP address taolea, routing tables and ARP tables are re- 
trieved. Gateways within the Maximum Hops threshold are appended to the Gateway list. 

The network manager 40 then proceeds down the Gateway list. Routing tables, I P addrsa ) tables and ARP tables 
of ths nsw entry on ths Gateway list are retrieved (step 1 22). Newly-discovered networks, subnets and gateways are 
added to the hierarchical data structure (etep 1 24}, and n ewly-dlacovered gateways within the M exlmum Hops threshold 
are appended to the Gateway list (etep 126). By appending newly cflscoversd gateways to tt e Gateway list and ad- 
vancing down the Gateway list, the network manager 40 leapfrogs from gateway to gateway Identifying even more 
routers, subnets and networks. Once the network manager 40 has reaches the end of the Gateway list (step 129). It 
has completed the construction of the hierarchical data structure. 

The steps 102-1 28 of building the hierarchical data structure can be skipped or modified If a Search file containing 
specific gateways Is made accessible to ths Discover program 56. The gateways In the Sea-ch flla are Identified by 
their IP addresses. If a speotfler (e.g. , ONLY) is provided in the Search file, ths search Is Itmttec only to those gatsways 
specified In the Search Ale. If the specifier is omitted, ths search begins with those gateways specified In the Search 
tils and then continues with the search above, accessing routing tables and IP address tables rom all gateways within 
the Maximum Hops threshold. Any gateway that Is unreachable Is Ignored Ths name of the 8c arch file can be entered 
on ths command line of the operating system or through the Discover Properties dialog box cf the GUI 54. 

After trie hierarchical data structure has been built, the network manager 40 performs a s< arch. It the Ping search 
is selected (step 1 30), the network manager 40 sends I CMP echo request messages over the network 1 0 (step 1 32). 
The network manager 40 can be programmed to send out ths ICMP echo request messages to all addresses on the 
network In a conventional manner, or it oan be programmed to perform a 'Fast Ping." as described below In connection 
with Figure 4. 

If either ths ARP/Ping or the ARP-only search is selected, the network manager 40 reprieves its local ARR IP 
address and routing tables using UNIX syetam calls (step 1 34). Then, using SNMP requeets, the network manager 40 
retrieves the ARP tables from ati gateways listed in the Gateway list (step 138). For example, the network manager 
40 might find the following ARP table from the first router 36: 



Device 


IP address 


IP Name 


Mask 


Phya Addr; 


16 


129.144.74.1 


udmpk16c-74 


255.255.255.256 


00:40: 05:40:76: 1d 


12 


129.144.74.6 


dakota-74 


256.255.255.255 


00:4C;Ob:4i>:f6:45 


14 


129.144.74.34 


eleada-74 


256.255.265.266 


0O:40:0b:4b:f6:46 


20 


129.144.75.12 


conc- 


266.265.255.265 


0S:00:20:7S:a3:9f 


22 


129.144.76.15 


ern p 


255.255.255.255 


0B:00:20:l6:2c:e7 


24 


129.144 76.114 


maaaureB-74 


256.255.255.255 


08:00;20:7b:7B:37 



The network manager 40 Immediately saves the IP addresses from the ARP table In the hlerarchJcaJ data structure 
(step 1 36). The network manager 40 can also ping each device that It finds In ths ARP table (atep 140). This step Is 
performed for verification purposes. 

The network manager 40 also immecSately classifies the devices (etep 142) and updates the network topology 
i 56 with the classified devices (step 144). Classification can be performed by reacfing the davioe'e SNMP 
system description (e.g., aya object ID) and mapping the system description to a particular device class. The network 
topology database 56 Is essentially an Internal hierarchy of data structure files and instance files. The data structure 
files Include structures of devices, vlawe (collections of devices), buses (e.g., a Token Ring LAN segment) and con- 
nections (eg., an RS-232 link). The network manager 40 polls the MIB of each discovered devfee tor system Informa- 
tion. The system Information Is passed to an Applications Program Interface (API) which, uelng basic API calls, creates 
Instance files of the data structures and adds ths Instance files to the network topology database 66. For a description 
of network topology databases, see C. Maiam ud, 'Ana lyzing Sun Networks', Nfen Noetrand Relnhold (1 992) pp. 41 9-21 , 
which Is incorporated herein by reference. 

If the ARP-only search was selected (step 146), the network manager 40 might try to Identify hosts (step 146). if 
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the ARP/Ping March to selected, the network manager 40 performs & more exhaustive search jon the network, sending 
ICMP echo request message* to the remaining addresses of the subnets listed In the Hierarchy file (step 160). The 
ICMP echo request messages can be sent in a conventional manner, or they can be sent using the Fast Ping method 
described above In connection with Figure 4. 
* Figure 4 shows the steps for performing the Fast Ping search. In step 200, the following vajjuea are specified before 

the ICMP echo request messages are sent ae IP packets by the network manager 40: 

1 . A maximum number L of outstanding ICMP echo request messages psr batch. 

2. A time T between transmissions of the batches of ICMP echo request messages. 

vo 3. A number of times R an ICMP echo request massage Is sent to a device. The values can be provided by a 
configuration flle when the Discover program 38 Is run from the command line, or the values can be provided via 
the Discover Properties dialog box If a value Js not provided to the Discover program 68, a delautt value Is used. 
The default value lor the maximum number of outstanding pings L Is 10. which allows only a single ICMP echo 
request message to be sent at any one lime. The default value for the time T between transmissions of the batches 
of ICMP echo requests le three seconds, which commands the network manager 40 to wilt three seconds before 
sending the next batch of ICMP echo request messages. The default value for the number of times R an ICMP 
echo request message is sent to a particular address la also 1 , which commands the network manager to send 
only a single ICMP echo request message to an address. 

i 

*0 The Fast Ping search is not exhaustive; It Is pe rf ormed only on those subnets and networks jhat have been identified 
in the hierarchical data structure. The network manger 40 determines a range of IP addresses tor each subnet from 
the hierarchical data structure (step 202). Batches of ICMP echo request messages are sent to each subnet within the 
corresponding range of IP addresses. The initial batch of messages can be sent to the first t| addresses on a subnet 
(step 204). The ICMP echo request massages In a batch are sent fci succession, ae fast as tne network manager 40 

£* can send them. The network manager 40 then walls for responses to the ICMP echo request messages (step 206). If 
a response is received (step 208), the network manager 40 saves ths IP address of the responding device In the 
hierarchical data structure and network topology database 58 (step 210) and thereafter waits for addtional responses 
(step 208). Ths network manager 40 continues waiting for responses until time T elapses or [until all responses to all 
L requests have been racmvsd. | 

*> If ICMP echo request messagae have been sent to the addressse of all subnets and nehjuorks In the hierarchical 

data struct urs (212), ihe Fast Ping method Is completed. 

Otherwise, ths network manager 40 keeps track of the IP addresses that have responded, ths ones that have not 
responded, the number of ICMP echo request meeeagee that have been sent to a particular address, and It accordingly 
sands the next batch of ICMP echo request messages (stsp 214). j 

96 The network manager 40 can use the Fast Ping method to perform a mlntaweep of the network. The network 
manager 40 sends out a batch of fifty ICMP echo request messages to the first fifty IP addresses of a oubnat Within 
a three second Interval, five responses are queued by the network manager 40. IP addresses of the five responding 
devices are stored In the hierarchical data structure and network topology database 58. After three seconds elapse, 
the network manger 40 esnde another batch of ICMP echo request messages to fifty IP addresses: the forty five 

40 addresses that did not respond, and ths fifty first address through the fifty fifth addresses. Two more Intervals of three 
second elapses and no additional responses are rscslved. The network manager 40 then formulates a new batch of 
fifty addresses: the fifty first address to the fifty filth address, and the fifty sixth address though the one hundred and 
fifth address. In this manner, the network manager 40 continues to sand out batches of ICMP echo request messages 
until all addresses In the Hierarchy file have been pinged. The mini-sweep is faster to perform than the conventional 

4$ method of pinging devices. 

Thus disclosed am apparatus and methods for discovering devices on a network quickly and efficiently, without 
creating excessive network traffic. Using any of the methods, a network manager can build a network topology data- 
base. 

It Is understood thai various changes and modificatione may be made without departing from the spirit and scope 
so of ths Invention- Although, certain methods above have been deecrfeed in connection with ARP tables, the methods 
can use any other table that maps an IP address to a physical address. ARP tables happen to be standard for 8NMP- 
managed networks. 

The Invention Is nol limited to network managers including workstations having RI8C processors that run UNIX- 
based operating systems. For example, the network manager can Include a personal computer having an xB8 or PEN- 
ss tium processor that runs a 32-btt UNiX-baeed operating system such as SOLARIS 2.4. The operating system does 
not even have to be UNIX-baaed. 

More generally, however, the above-methods of discovering devices can be run on any host that is capabla of 
sending pings to other devices and/or accessing ARP tables from other devices. 
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Claim* 

1. A method of discovering devlcee on a network, comprising the etape of: 

accessing on ARP (Address Resolution Protocol) table from at Isaet one device orj the network Inoludlng 
accessing a local ARP table; and 
using each acceesed ARP table to Identify other devices on the network. 

i 

2. The method of claim 1 , wherein the step of accessing an ARP table from at least one devtte Inoludee the steps of: 

Identifying a number N of gateways on tha network, where N Is a positive Integer; and 
retrieving an ARP table from at least one of the identified gateways. 

3. The method of claim 2, wherein the step of accessing an ARP table from at least one devl :e Inoludee the steps of 
retrieving ARP tables from hosts identified In the retrieved ARP tables. 

4. The method of claim 3, wherein the step of accessing an ARP table from at least one eta Ice further Includes the 
etepe of: 

accessing routing tables to Identify gateways; 

determining a number of hope to each of the gateways In the routing tables; and 
retrieving ARP tables from the Identified gateways that are within a maximum hops threshold. 

6. The method of olalm 4, wherein the number of hope is determined by performing a tracjeroutee operation, and 



wherein the step of accessing an ARP table from at least one device further includes the 



steps of: 



searching for gateways that are revealed by the traeeroutee operation; and 
retrieving ARP tables from the gateways that are revealed by the traeeroutee operation. 

so a. The method of claim 4, wherein the step of accessing an ARP tabla from at least one device further Includes tha 
steps ot: 

Identifying additional gateways from ARP tables of previously-Identified gateways; anid 
retrieving ARP tables from the additional gateways that are within the maximum hops' threahold. 

96 

7. The method of dafm 4, wherein the step of accessing an ARP table from at leaat one devfee on the natworkf urther 
Includes the steps of: 

accessing a file Identify big at (east one gateway; 
<w retrieving an ARP table from each gateway Identified In the file; and 

search fng lor ARP tables from additional gateways on the network. 

6. The method of claim 1 , further comprising the step of sending pings to devices on the network. 

9. The method of claim 8, wherein a ping is sent to each device that Is Identified h an ARP table. 

10. The method of claim 8, wherein the step of sending tha plnga Includes the steps of: 

sending a batch of pings to addressee on the network; 
so waiting an Interval for responses from devlcee at those addresses to which the plnge were sent; and 

sending out at least one other batch of pings after the Interval expiree. 

11. Apparatus for discovering devices on a network, comprising 

66 means for accessing an ARP (Address Resolution Protocol) table from at least one device on the network, 

including a local ARP table; and 

means for using each acceesed ARP table to identify other devices on the network. 
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1 2. The apparatus of claim 1 1 , wherein the means for accessing an ARP table from at least ine device Includes 

means for identifying a number N of gateways on the network, where N Is a positive Integer; and 
means for retrieving an ARP table from at least ono of the Identified gateway*. 

1 3. The apparatus of claim 1 2, whareH the means for accessing an ARP table from at least on< \ device includes means 
for retrieving ARP tables from hosts identified In the retrieved ARP tables. 

1 4. The apparatus of claim 1 3, wherein the means for accessing an ARP table from at least one device includes: 

means for accessing routing tables to Identify gateways; 

means for determining a number of hops to each of the gateways in the routing table's; and 
means for retrieving ARP tables from the Identified gateways that are within a marfrr urn hope threshold. 

if 1 6. The apparatus of claim 14, wherein 

the number of hops Is determined by performing a traceroutee operation; 
the means for accessing an ARP table from at least ens device Includes: 



10 



80 



30 



means for searching for gateways that are revealed by the traceroutea operattor 



means for retrieving ARP tables from the gateways that are revealed by the tract* routs* operation. 
16. The apparatus of claim 14, wherein ths meana for accessing an ARP table from at least Ane device includes: 



Identifying additional gateways from ARP tables of prevtoualyHdemtfled gateways; ar d 
retrieving ARP tables from the additional gateways that are with In the maximum hop \ threshold. 

17. The apparatus of claim 14, wherein the means foracoeealng an ARP tablefrom at least on|e device on the network 
includes: 



and 



means for accessing a file identifying at least one gateway; 
means for retrieving an ARP table from each gateway Identified In the file; and 
meana for eearchlng for ARP tables from additional gateways on the network 

13. The apparatus of claim 1 1 , further comprising means for eendlng pings to devices on the network. 

10. The apparatus of claim 18, wherein the ping Bending means sends a ping to each device that la Identified lr> an 
ARP table. 

20. The apparatus of claim 18, wherein ths ping sending means Includes: 
means for sending a batch of plngs to addressee on the network; 

means for waiting en Interval for responses from devices at those addresses to which ths phge were sent; and 
means for sending out at least one other batch of plngs after the Interval expires. 

46 
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s The Invention relates to digital eommunfcallons. Wore specifically; the Invention relate* to 

Today, large numbers of personal computers and workstations are being Interconnected 
servers, modems, hubs and other devices to form local area networks, metropolitan area 
networks These networks allow the personal computers and workstations to share Information 
among each other. Now more than aver, Individuals and companies depend on networks to 

io communicate with people around the world. Indeed, the network has become the computer. 

A network manager la employed to control operations of devices on the network, analyze! 
Identify and resolve faults, and automate management tasks. Track of the devices Is kept by wny of 
database. The network manager can dynamically build the database by discovering the device* 
and adding the discovered devices to the database. 

19 Acc^verittonalmsthodofdiscovertngdevlces is known as 'aerlaJ pinging.' The network manager eends 

Control Message Protocol (I CMP) eoho request message to an addrees and waita for a 
received, or alter a timeout Interval expires, the network manager sends an ICMP aoho request 
serial address. These steps are performed until ICMP echo requast messages have been sen t 
network. The device* that respond are added to the network topology database. 

so Serial pinging has Its problems. Forone, Itcanbetakea very tang time to decover ad evicja 
C type support up to 265 addressee, but not all of those addressee will be active. Even thou jh 
be active on a class C network, requests would atfll be sent serially to all 258 addressee. Vti Iting 
each non-response at 250 addresses, the network manager could take aa long as 16 minutes 
class C network. The problem is far greater with class B networks (whloh eupport up to 65, 

*6 A network* (which eupport up to 65 million addresses). On a class A network it could take ae 
a hoar. 

Another problem with ssrlal paging is that It increases the traffic on the network and, 
other devtoes on the nefcvork. Many devices stop oommunlcatlng with other device* in order 
echo response request message. 
30 Yet another problem with pinging is that the method, as exhaustive as ft might be, Is not 

devices on a network. Some router*, when busy, will Ignore ICMP eoho request meeeagee 

§ummarv of the Invention 

36 These problems are overcome by apparatus and methods according to the present Invention. A first method of 

discovering devices on a networH comprises the steps of accessing an ARP table from at least one device on the 
network; and using each accessed ARP table to identify other devices on the network. The first method can discover 
devices on the network at far greater speed than the conventional method of sending plngji. The first method also 
creates far lees trarTto on the network when discovering the devices. 

40 A second method of discovering devices on a network c ompriees tha eteps of sending bat shea of pings to different 
addressee on the network; and, for each batch, wafting an interval for responses from devices at those addressee. 
After the Interval elapses, another batch of pinge le sent. The second method Is also faster than the conventional 
method of sending pings. It can be performed Independent of, or in combination with, the ftr^t method of diecoverlng 
devices on a network. j 

45 A method ot determining a hierarchical structure of a n at work comprise* the steps of accessing routing tables to 

Identify routers on the network; accessing addrees translation tables from the routers to idefjtrry other devices on the 
network; and saving IP addresses of the routers and the other devices on tha accessed routing tables and address 
translation tables. j 

An apparatus for discovering devices on a network comprises a processor for accessing at least one routing table. 

so Identifying gatewaye within N hops on each routing table that Is accessed, where N Is a pcjsttive Integer, accessing 
ARP tables from the gateways thai are Identified, and Identifying devices on the ARP tables (that are accessed. 

A network manager for managing addressable devices on at least one network comprises p processor and memory 
for storing a network topology database and a plurality of executable instructlone. When executed, the Instructions 
instruct the processor to use routing tables to Identify rouiera within N hope; retrieve ARP fables from the Identified 

« routers; Identify devices on the retrieved ARP tables; access Information from the identified devices; and add the 
information to the network topology database. 

The Invention also include* a computer storage medium that stores a plurality of executable Instructions for In- 
structing a computer to discover devices on a network. The plurality of instructions comprises instruct tone which Inetruot 
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the computer to use routing tables to Identity gateway* within N hops; Instructions which i 
retrieve the address translation tablee from the Identified gateways; and Instructions which 1 
Identity devlcee on the retrieved address translation tabtee. 



rtetrutrt the computer to 
Instruct the computer to 



Brief Description of the Drawings 



the present invention; 
performed by the net work 



Fig j re 1 Is a schematio diagram of a network Including a network manager according to 
Figure 2 la a block diagram of the network manager according to the present hventlon; 
Figure 3 la a flowchart of a method of discovering devlcee on a network, the method being 
manager according to the present Invention; and 
Figure 4 la a flowchart of a Fast Ping method according to the present Invention. 

Detailed Deecription otthe Invention 

Figure 1 shows a network 10 which, for illustrative purpoeea, Includee flrat, second and third subnet* 91 , S2 and 
33 The subnets 81 , 82 and S3 can have the same topology or they can have different topaloglaa. The topologies 
Include, but are not limited to. Token ring, Ethernet, X.25 and FDDI. Devlcee 12. 14 and 16 a e connected to the first 
aubnet 81; devices 18, 20, 22 and 24 are connected to the second subnet S2; and devices 2». 26, 30, 32 and 34 are 
connected' to the third eubnet 38. The devlcee 12-34 can be workstations, personal computers, hubs, printers, eta. 
Additional devices on the network 10 Include a first router SB for Interconnecting the flrat, second and third subnets 
St 82 and S3; and a eecond router 38 for connecting the second subnet S2 to other netwarks. The network 10 is 
scalable, which allows computing resources to be added as needed. Although only several devlcee 12-38 are shown, 
the network 10 can encompass tene of addressable devices Up to tene ol thousands of addn eeable device*. 

TCP/IP is used to regulate how data la packeted Into IP packets and transported between the devlcee 1 2-38. Each 
device 12-38 has a phyelcal address and a unique Internet protocol (IP) address. The IP address Includes a network 
number and ft host number. The host number Is broken down Into a subnet part and a host part. 

Take a first example In which IP packets are sent from a aource device on the first etbnei 81 (device 12. for 
example) to adestlnatton device on thef Irst subnet 61 (device 14, for example). The IP packets eenteinthe IP addreee 
of the destination device 14 The subnet part of the destination IP address Indicates that the destination device 1 4 Is 
local so the source device 12 retrieves Its local ARP (Address Reeolutlon Protocol) table t orn its ARP cache. The 
ARP table Is used for mapping the IP address onto a physical addreee. It the destination IP address is found on the 
ARPtable, the ecuroe device 1 2 reade the phyelcal addreee off the local ARP table, adde appro ulate header© (including 
the phyelcal addreee of the declination device 14) to the IP packets, and esnds the resulting fr ime over the first subnet 
81. 

If the destination device 14 Is not on the ARP table, the eource device 1 2 Issues an Al V s request to locate the 
destination device 14. The ARP request Includee the IP and physical addresses of the source device 12 and the IP 
address of the destination device 1 4. All devices receiving the ARP request check to eee if t islr IP address matches 
the destination IP addreee In the ARP request. Of course, the destination device 14 makes e match and responds by 
reluming Its phyaical addreee to the source device 12. The aource dsvtee 12 makes an entry lor the destination device 
14 in he ARP table (the entry Including the physical address of the destination device 1 4), exlde the physical address 
of the destination device 1 4 to the IP packete, and transmits the resulting frames over the fir it subnet 83. 

Take a second example In which IP packets are sent from the source device 12 to a deaU latlon device on the third 
subnet S3 (device 30, for example). The subnet part of the destination IP address indicates that the destination device 
30 la not local, so the eource device 12 retrieves Its local routing table from the ARP cache. The local routing table 
contains informal Ion needed to route the IP packets to next-hop gateways. The information iio&Jdee entries that Indicate 
the next-hop routers by their IP addresses. At a minimum, the local routing table contalne an entry for a default routet 
In thfe example, the default router ie the flret router 38. The routing table may also contain mriny other entries for other 
gateways on the network 10. Ttie eource device 1 2 forwards the IP packets to the first routed 38. 

The first router 38 receives the IP packets and retrieves an IP address table Irom Its ARP cache. The IP address 
table Includes an address for each Interface. In this example, the IP address table Includee] P address 129.144.74.1 
for the flrat eubnet 81, IP address 12B.144.7S.1 for the eecond eubnst 82, and IP address 129.144.78.1 for the third 
subnet S3. By masking the destination IP addreee to obtain its subnet part (a mask Irom the 3P address table Is used) 
and comparing the masked IP address to the addressee In the IP address table, the flrat routjsr 36 determines that the 
IP packets should be sent to the third eubnet S3. The.flrst router 36 looks at Its ARP table jwhich waa retrieved with 
the IP address table) lor the physical address of the destination device SO. The flret router 3ft maintains an ARP table 
of the devices thai have been active (I.e., communicating) over an Interval (e.g., five minuted). 

Itthe destination IP address le not on Its ARP table, the first router 38 Issues an ARP request. After ths dsstlnatton 
device 30 la found, the first router 38 adds the destination physical address to thelP packets and transmits the resulting 
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f rarnee over the 1h!rd subnet S3 to the destination device SO. 

Had the daetlnatlon IP address not fit m one of the subnets on the IP address table, the tin \X router 36 would have 
checked Its routing tabid (which was also retrieved with the IP address table) and forwarded thq IP packata to the next- 
hop router (I.e., the second router 38). I 

* The network 10 additionally Inoludee e network manager 40, which is connected to the first subnet 81. Simple 

NetworkManagementPretocol(8NMP)l8 used bythenetworkmanager 40 for managing the devices 12-38 that support 
SNMP. The devices 12-38 that do not eupport 8NMP can ba managed by a protocol auch u ICMP. Each SNMP- 
manageable device etores in its memory a Management Information Base (MIB). The MIB Is s collection of objects or 
variables representing differsnt aspects of the device (e.g.. configuration, statistics, status, control). Each device is 

10 associated with an agent, which is a software prog ram that may or may not ba resident In the o *v Ice. The agents allow 
the network manager 40 to access the MIB of each SNMP*manageable device. Such accessibility allows the network 
manager 40 to perform Its management tasks. For a general description of network manage nent, see W. Stalling* 
"Dataand computer Communications.- MaoMillan (4ih ed, 1 994) pp, 701 -24, which Is Inoorpora »d herein by reference. 
Figure 2 shows the network manager 40 In greater detail. The network manager 40 Includes a workstation 42 such 

ib M a SPARCetatlon or 8PARCaerver. Both of these models uee a RISC-baeed h I gji -performs ice SPARC microproc- 
essor 45. The SPARCatatbn, SPARGserver, and SPARC microprocessor are all oommerclilly available from Sun 
Microsystems, Inc., the assignee of the present invention. The workstation 42 Is configured wlU i a color display monitor 
44 and a CD ROM drive 46 for distribution media. It is alao configured with volatile memory 48 such as DRAM and 
non-volatile memory 50 such as a hard drive. 

so The Network Manager 10 Includes a UNIX-based operating systsm 52. Operating systems for the SPARC micro- 
processor Include SOLARIS 2.4 or greater and SOLARIS 1 .x or later. The SOLARIS operating systems are also com- 
mercially available from the assignee of the present invention. The operating system 52 la stored on the network 
manager's hard o>tve 50. 

Also stored on the hard drive 50 Is software for directing the network manager 40 to perk >rm Its many tasks. The 
es software Includes a Graphical User Interface (QUI) 64, a network topology database 66 and i Discover program 56. 
Running the Discover program 66, the network manager 40 eeeks out IP and SNMP-addmesabte devices on the 
network 1 0. and adde instances of Discovered devices to the network topology database 66. 

The Discover program 56 can be distributed on a portable computer memory medium, such as a CD ROM. Dis- 
tributed as such, the CD ROM Is Inserted into the CD ROM drive 46 and the Discover progran 1 59 is installed onto the 
30 hard drive 50. instead of Installing the Discover program 56 onto the hard drivs 60, however, it can be accessed directly 
from the CD ROM drive 48. 

The Discover program 68 oan be run directly from the operating system 62. The location and name of tha Discover 
program's executable file are typed in at tha command Una. Specifiers can also be typed in ut the command line, or 
they can ba provided In a configuration file, if no specifiers are typed In at tha command kin >. default specifiers are 

& used. The specifiers, which provide options for running end configuring the program, will be c lecussed below 

In the alternative, the Discove r program 58 can be run from the GUI 54. A Discover program loon la double clicked, 
causing a D Iscover Properties dialog box to appear. The Dleoove r Propertl es dialog box shows 1 he cu rrem conflgu ration 
of the Discover program, provides an option that allows the Discover program to bs reconfigured with new specifiers, 
and a button for running ths Discover program 58 as currently configured. The QUI 64 can be created using Open- 

40 windows 9.1 or later, or any other library of graphical user Interface classes. 

Reference Is now mads to Figure 3, which shows th a steps performed by the network manger 40 under the dlrscllon 
of ths Discover program 58. The Discover program 58 offers a choice of searches: an ARP/Pihg search, an ARP-only 
search, and a Ping search (step 100). One IS selected. The ARP/Phg search is selected by ijlefauH. If It is desired to 
psrform either the ARP-only search or the Ping search, a specffler (e.g., -A or -P) is typed Iniat the command line or 

4* button (e.g., ARP-only button or Ping button) Is clicked on in the Discover Properties dialog bjox. 

The network manager 40 begins with the steps of building a hierarchical data structure ^f ths network topology. 
The hierarchical data structure Indicates networks, subnets for each network, and gateways, hosts and links (physical 
and logical) for each subnet. The data structure la stored In non-volatile memory 60. To bujld the hierarchical data 
structure, the network manager 40 accesses Its IP address table end local routing table in ltd ARP cache (step 102). 

so I P addresses In ths IP address table, which are used to Identity the subnets, are added to the hierarchical data structure 
(step 1 04). The focal routing table ie used to identify a default router. Ths local routing table might also Identify additional 
gateways. IP addresses of the default router and any other gateways are added to the hierarchical data structure (etsp 
106). 

The IP addresses of the routers are also added to a Gateway list, which Is stored In mefnory 48 or 60. Before a 
SB gateway is saved in the Gateway list, however, the network manager 40 performs a traceroutae operation to determine 
the number of hops to that gateway (stop 10B). Each gateway that a packet must traverse 14 counted as a hop. The 
traceroutee operation also Idsnlffles physical and logical links, which are added to the hierarchical data structure (etep 
110). if a gateway Is within a 'Maximum Hops 1 threshold, its IP address Is appsnded to the Gateway list (step 1 12). 
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By default, the Maximum Hops threshold is tM to zwo so thai only the local ARP Cache la acdessed. 

If the Maximum Hope threshold Is greater than zero (step 1 1 4). the network manager 40 ret levee the routing table, 
IP eddrese table and ARP table of the default router using a aeries of SNMP GeLNext messages (step 118). The 
default router's IP addreaa table indicate* the IP addresses of the subnets 82 and 52 and my other Interfaces, IP 
addresses of the Interlace are added to the hierarchical data structure (step 118). Tne default routers routing table 
identified other gateways, which are added to the hierarchical data structure. Only IP addressee of thews gateways 
within the Maximum Hops threshold are appended to the Gateway Ibt (atop 120). 

If the default router does not support SNMP, the network manager 40 can use the traceioutea operation to find 
additional gateways. If additional gateways are found, their IP address tables, routing tables md ARP tablea are re- 
trieved. Gateways within the Maximum Hops threshold are appended to the Gateway list. 

The network manager 40 then proceeds down the Gateway list. Routing tables, IP addreai tables and ARP tables 
of the next entry on the Gateway Net are retrieved (step 122). Newly-discovered networks, sut nets and gateways are 
added to the hierarchical data structure (step 124), and newly-discovered gateways within the Mi uclmum Hops threshold 
are appended to the Gateway list (step 128). By appending newly discovered gateways to tre Gateway fist and ad- 
vancing down the Gateway lief, the network manager 40 leapfrogs from gateway to gateway identifying even more 
routers, subnets and networks. Onoe the network manager 40 has reaches the and of the Gateway list (step 128), it 
has completed the construction of the hierarchical data structure. 

The steps 102-128 of building the hierarchical data etructure can be skipped or modified If a Search file containing 
specific gateways Is made accessible to the Discover program 58. The gateways In the Seaieh file are Identified by 
their IP addressee. If eepecflier (e.g., ONLY) la provided In the Search file, the search Is limited only to those gateways 
specified In the Search file. If the specifier le omitted, the search begins with those gateways specified In the Search 
file and then continues with the search above, accessing routing tables and IP address tables Irom ail gateways within 
the Maximum Hops threshold. Any gateway thai is unreachable le Ignored. The name of the 8earch Ilia can be entered 
on the command ibie of the operating system or through the Discover Propertied dialog box of the GUI 64. 

After the hierarchical data structure has been built, the network manager 40 performs a si arch. II the Ping search 
la selected (step 1 90). the network manager 40 sends ICMP echo request messages over thi network 1 0 (step 1 32). 
The network manager 40 can be programmed to send out the ICMP echo request messages to all addresses on the 
network In a conventional manner, or It can be programmed to perform a •Fast Ping," as deserll ted below In connection 
with Figure 4. 

If either the ARP/Plng or the ARP-onry search te eeleoted, the network manager 40 retrlevea as local ARP, IP 
address and routing tablee using UNIX system calls (step 1 34). Then, using SKIMP requests, tie network manager 40 
retrieves 1hs ARP tablee from all gateways listed in the Gateway list (step 136). Por exampl^. the network manager 
40 might find the following ARP table from the first router 38: 



93 


Device 


IP address 


IP Name 


Mask 


Phya AddrJ 




18 


129.144.74.1 


udmpk18c-74 


255.255.255.268 


00:40:0b* 


(0:78: 1d 




12 


129.144.74.6 


dakota-74 


2S5.256.265.255 


00:40:0b:' 


to;f6;46 




14 


129.144.74.34 


eleackv74 


265.266.255.255 


00: 40:0b:-* 


|0:t6:43 


40 


20 


129.144.75.12 


certo 


265.266.255.25S 


08:00:20:1 


8:a3:9f 




22 


129.144.75.15 


emp 


255.255.255,255 


06:00:20:1 


0:2c:e7 




24 


129.144.75.114 


meaeuraa-74 


255.255.266.255 


08:00:20:1 


te:7fl:37 



The network manager 40 Immediately saves the IP addressee from the ARP table In the hierarchical data etructure 
(step 138). The network manager 40 can also plng each device that ft finds In the ARP table (step 140). This step is 
performed for verification purposes. 

The network manager 40 also Immediately classifies the devices (step 142) and updatte the network topology 
database 59 with the ctaeetfled devices (step 144). Classification can be performed by reading the device* SNMP 
systsm description {e.g., eyeobject ID) and mapping the eyetem description to a particular deVles class. The network 
topology database 56 Is essentially an Internal hierarchy of data etructure flies and Instance (files. The data etructure 
files include structures of devices, views (collections of devices), buses (e.g., a Token Ring LAN segment) and con- 
nections (e.g., an RS-232 link). Tha network manager 40 polls the MIB of each discovered deyice lor system Informa- 
tion. The system Information Is passed to en Applicative Pnogram Interface (API) which, usini basic API oalla, creates 
Instance files ol the data structure* and adds the Instance files to the network topology database 58. For a description 
of network topology databasee, see C. Malamud, 'Analyzing Sun Networks' 1 , van Nostrand Relhhotd (1 992) pp. 41 9-21 , 
which is Incorporated herein by reference. 

If the ARP-only search was selected (step 146), the network manager 40 might try to W$ntliy host© (step 148). If 
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the ARP/Phg search is selected, the network manager 40 perform* a more exhaustive search 
iCMP echo requeet moeeagee to the remaining addressee of the subnets Hated In the " 
ICMP echo request messages can be sent In a conventional manner, or they can be sent 
described above in connection with Figure 4. 

Figure 4 shows the steps for performing the Faet Ptng search. In step 200, the following val 
the ICMP echo request messages are sent as IP packets by the network manager 40: 



i >n the network, sending 
Hierarchy file (step 160). The 
usirJgthe Faet Ping method 



ies are specified before 



1 . A maximum number L of outstanding IOMP echo request messages per balch. 

2. A time T between transmissions of the batches of ICMP echo request messages 

3. A number of tlmee R an ICMP echo request message Is eent to a devioe. The veiuejB 
configuration file when, the Discover program SB is run from the command line, or the 
the Discover Properties dialog box. II a value Is not provided to the Discover program 56, 
The default value for the maximum number o1 outstanding pings L Is 10, which allows 
request message to be sent at any one time. The delauri value for the time T 
of ICMP echo requests ia three seconds, which commands ths network manager 40 to 
sending the next batch of ICMP echo request messages. The default value tor the 
echo request message Is sent to a particular address Is also 1 , which commands the 
only a single ICMP echo requeet massage to an address. 



val ibs 



only 



between tran< missions of the 

Wiilt 

i number 



n< twork i 



[or additional responses 
until all responses to all 



Ths Fast Ping search is not exhaustive; ft Is performed only on those subnets and networks hat have been Identified 
In me hierarchical data structure. The network manger 40 determines a range of IP address m tor each subnet from 
the hierarchical data structure (step 202). Batches of ICMP echo request messages are sent 1 > each subnet within the 
corresponding range of IP addresses. The initial batch of messages can be eent to the first I addresses on a subnet 
(step 204). The ICMP echo requeet meesages in a batch are sent In succession, aa fast as tie network manager 40 
can send them. The network manager 40 then waits lor responses to the ICMP echo request messages [step 206). If 
a response Is received (etep 208), the network manager 40 saves the IP address ol the n ^ponding device. In the 
hierarchical data structure and network topology database 56 (etep 210) and thereafter waits 
(etep 206). The network manager 40 continue* waiting for responses until time T elapses or i 
L requests have bean received. 

if ICMP echo request meesages have been eent to the addressee of all eubnets and nstjworka In the hierarchical 
data struct are (212), the Fast Ping method is completed. 

Otherwise, the network manager 40 keeps traok of the IP addresses that have responded, tha ones that have not 
responded, the number of ICMP echo request meesages that have been sent to a particular acjdress, and It accordingly 
sonde the next batch of ICMP echo request meeeages (step 214). 

The network manager 40 can use the Fast Ping method to perform a minl-eweep ot tha network. The network 
manager 40 sends out a batch ol fifty ICMP echo request messages to the first fifty IP addresses ol a subnet. Within 
a three second Interval, five responses are queued by the network manager 40. IP address* * of the five responding 
devices are stored in the hierarchical data structure and network topology database 58. Aft* r three seconds elapse, 
the network manger 40 sends another batch of ICMP echo requeet meesages to fifty IP addresses: the tony five 
addresses that dW not respond, and the fifty first address through the fifty fifth addresses. TWf> more Intervals Of three 
second elapses and no additional responses are received. The network manager 40 then fdrmulates a new batch of 
fifty addressee: the fi fty first address to the fifty ffm address, and the fifty ebrth address though the on© hundred and 
fifth addrees. In this manner, the network manager 40 continues to send out batches of ICMP echo request meesages 
until all addrss8es In the Hierarchy file have been pinged. The mini-eweep Is fastsr to poffotim than the conventional 
method of pinging devices. • 

Thus disclosed are apparatus and methods for discovering devices on a network qubkjy and efficiently, without 
creating excessive network traffic Using any of the methods, a network manager can build a network topology data- 
base. 

It Is understood that various changes and modifications may be mada without departing from the spirit and scops 
of the Invention. Although, certain methods above have been described In connection with |RP tables, the methods 
can use any othsr table that maps an IP address to a physical address. ARP tables happen to be standard lor 5NMP- 
managed networka 

The rventlon Is not limited to network managers Including workstations having RISC pfoceseors that run UNIX- 
based operating systems. For example, the network manager can Include a personal computer having an xfie or PEN- 
TIUM processor that rune a 32~b!t UNIX-based operating system such as SOLARIS 2.4. The operating system does 
not even have to be UNIX-based. 

More generally, however, the above-methods of dlscovsrlng devices can be run on any hoai that Is oapable of 
sending pings io othsr devices anoYor accessing ARP tables from othsr devices. 



can be provided by a 
can be provided via 
a default value is used, 
a single ICMP echo 
batches 
three seconds before 
of times Ran ICMP 
manager to send 
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Claim* 

1. A method of discovering devices on a network, comprising the steps of: 

accessing an ARP (Address Resolution Protocol) table from at least one device on 
accessing a local ARP table; and 

using each accessed ARP table to Identify other devices on the network. 



the network, Including 



10 



IS 



20 



2. Trie method of claim 1. wherein the step of accessing an ARP table from at loeet one device Includes the steps of: 

Identifying a number N ol gateways on the network, where N Is a positive Integer; am 
retrieving an ARP table fnorn at least one of the Identified gateways. 

3. The method of claim 2, wherein the step of accessing an ARP table from at I seat one device Includes ths steps of 
rstrlsvhg ARP tables from hosts Identified in the retrieved ARP tables. 

4. The method of claim 3, wherein the step of accessing an ARP table from at least one device further Includes the 
steps ol: 



accessing routing tables to identify gateways; 

determining a number of hops to each of the gateways In the routing tables; and 
retrieving ARP tables from the identified getaways that are within a maximum hops threshold. 

5. The method of claim 4, wherein the number of hops Is dstermlned by performing a tracaroutee operation, and 
& whsreln the step of accessing an ARP table from at least one device further Includes the pteps of: 

searching for gateways that are revealed by the traceroutee operation; and 
retrieving ARP tables from the gatsways that are revealed by the traceroutee operation. 

so b» The method of claim 4, wherein ths step of accessing an ARP tabls from at least one devtee further Includes the 
steps of: 

identifying additional gateways Irom ARP tables of previously-identified gateways; sfjd 
retrieving ARP tables from the additional Gateways that are within the maximum hop^ threehold, 

36 

7. The method of clafrn 4, wherein the step of accessing en ARP table from at least one device on the network further 
includes the steps of. 



40 



accessing a file Identifying at least one gateway; 

retrieving an ARP table from each gateway identified In the file; and 

searching for ARP tables from additional gateways on the network. 

6. The method of claim 1 , further comprising the step of sending phgs to dsvlces on the nejwor k. 

9. The method of claim 6, wherein a ping is ssnt to each device that is Identified in an ARP table. 

1 a Ins mathod of claim 8, wherein the step of sending the pings includes the steps of: 

sending a batch of pings to addresses on the network: 

waiting an interval for responsee from dsvlces at those addresses to which the pings' were senl; and 
sending out at least one other batch ol pings after the interval expires. 



ss 



11. Apparatus for discovering dsvlces on a network, comprising 

means for accessing an ARP (Address Resolution Protocol) table from at toast one: 
Including a local ARP table; and 

means for using each accessed ARP table to Identify other devices on ths network. 



device on the network. 
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12. The apparatus of claim 11 , wherein the means for accessing an ARP tHhie f rem at l&a&t oh* device includes 

means tor identifying a number N of gateway* on the network, where N Is a positive Integer; and 
means for retrieving an ARP table from al least one ol the Identified Gateways. 

13. The apparatus of cfalm 1 2, wherein the meane for accessing an ARP table from at least onejdsvice Includes means 
for retrieving ARP tables from hosts identified In the retrieved ARP tables. 

14. The apparatus of claim 1 3, wherein the means for accessing an ARP table from at least t ne device includea: 

means for accessing routing tables to Identify gateways; 

means for determining a number of hope to each ol the gateways In the routing table* and 
means for retrieving ARP tables from the Identified gateways that are within a maximum hope threshold. 



ts 15. The apparatus of claim 1 4, wherein 

ma number ol hope Is determined by performing a traeereutee operation; 
tha meane for accessing an ARP table from at least one device Includes: 



means tor searching for gateways that are revealed by the traoeroiitas opsratlor ; and 
means for retrieving ARP tables from the gateways that are revealed by the trac routes operation. 

16. The apparatus of claim 14, wherein the means 1or accessing an ARP table from at least i >ne device Includea: 

idantlfylng additional gateways from ARP tables of previously-identified gateways; ard 
retrieving ARP tables from the additional gateways that are within the maximum hop s threshold. 

1 7. The apparatus ol claim 1 4, who rein the means for accessing an ARP table from at least or o device on the network 
includes: 



means for accessing a Hie identifying at least one gateway; 
means for retrieving an ARP table from each gateway identified In the file; and 
means for searching for ARP tables from additional gateways on the network. 

x la. The apparatus ot claim 11. further oomprislng means tor sending pings to devices on the network, 

la. The apparatus of claim 18. wherein the ping sending meane sends a ping to each device that Is identified In an 
ARP table. 

40 aa The apparatus of claim 18, wherein the ping sending meane Includes: 

means for sending a batch of pings to addressee on the network; 
means for wafting an interval for responses from dsvlces at thoee addresses to which the plngs were eent; and 
means for sending out at least one other batch of ping* after the Interval expiree. 



55 
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